Edit

Workflow Security

  • Article

Windows Workflow Foundation (WF) is integrated with several different technologies, such as Microsoft SQL Server and Windows Communication Foundation (WCF). Interacting with these technologies may introduce security issues into your workflow if done improperly.

Persistence Security Concerns

  1. Workflows that use a Delay activity and persistence need to be reactivated by a service. Windows AppFabric uses the Workflow Management Service (WMS) to reactivate workflows with expired timers. WMS creates a WorkflowServiceHost to host the reactivated workflow. If the WMS service is stopped, persisted workflows will not be reactivated when their timers expire.

  2. Access to durable instancing should be protected against malicious entities external to the application domain. In addition, developers should ensure that malicious code can't be executed in the same application domain as the durable instancing code.

  3. Durable instancing should not be run with elevated (Administrator) permissions.

  4. Data being processed outside the application domain should be protected.

  5. Applications that require security isolation should not share the same instance of the schema abstraction. Such applications should use different store providers, or store providers configured to use different store instantiations.

SQL Server Security Concerns

  • When large numbers of child activities, locations, bookmarks, host extensions, or scopes are used, or when bookmarks with very large payloads are used, memory can be exhausted, or undue amounts of database space can be allocated during persistence. This can be mitigated by using object-level and database-level security.

  • When using SqlWorkflowInstanceStore, the instance store must be secured.

  • Sensitive data in the instance store should be encrypted. For more information, see SQL Server Encryption.

  • Since the database connection string is often included in a configuration file, windows-level security (ACL) should be used to ensure that the configuration file (Web.Config usually) is secure, and that login and password information are not included in the connection string. Windows authentication should be used between the database and the web server instead.

Considerations for WorkflowServiceHost

WF Security Pack CTP

The Microsoft WF Security Pack community technology preview (CTP) 1 is a set of activities and their implementation based on Windows Workflow Foundation in .NET Framework 4 (WF 4) and Windows Identity Foundation (WIF). The Microsoft WF Security Pack CTP 1 contains both activities and their designers which illustrate how to easily enable various security-related scenarios using workflow, including:

  1. Impersonating a client identity in the workflow

  2. In-workflow authorization, such as PrincipalPermission and validation of Claims

  3. Authenticated messaging using ClientCredentials specified in the workflow, such as username/password or a token retrieved from a Security Token Service (STS)

  4. Flowing a client security token to a back-end service (claims-based delegation) using WS-Trust ActAs